Vulnerability Management that developers won't hate
summary
Shows concrete moves: generate and commit VEX documents with an automated justification so CI stops failing for not-affected libs; run renovate bot to open PRs and validate upgrades with tests; pipe cloud scanner alerts from AWS Inspector into SQS → Lambda → Jira to auto-create owner-assigned tickets; use code-reachability analysis and admission controllers to suppress unreachable vulns and block unscanned images; capture metrics in DynamoDB to prove reduced exposure and faster time-to-remediate.
AI-written summary · about
chapters (15)
- 0:00Introduction and Speaker Background
- 1:16Goals of the Talk
- 2:22Understanding Vulnerability Management
- 4:41Types of Vulnerabilities
- 5:15Dependency Vulnerabilities
- 7:13Docker Image Vulnerabilities
- 9:38Vulnerability Management FAQs
- 12:32Traditional Vulnerability Management
- 16:58Challenges in Conventional Programs
- 19:19Revamping Vulnerability Management
- 19:33Event-Driven Architecture and Cloud Solutions
- 31:18Automation Strategies
- 38:50Kubernetes and Container Security
- 41:32Quantifying and Reporting Vulnerability Management
- 43:32Conclusion and Final Thoughts
related talks
29mContainer vuln management with (hopefully) minimal...
33mVulnerability Management Lifecycle in DevSecOps
27mEffective Vulnerability Management for a DevSecOps Pipeline
33mFrom Chaos to Calm: Vulnerability Management for a Dynamic, Sprawling Technology Estate
01h 00mVulnerability management at scale drives enterprise transformation
23mTurbocharge your development with agile security
01h 06mEscaping Vulnerability Hell: Bridging the Gap Between Developers and Security Teams
30mTopics of Interest: Automatic Vulnerability Remediation: The Trusted and Secure Road ...